icorodovias[.]top

This domain, icorodovias.top, presents a confirmed phishing threat targeting users of digital toll payment systems. The site impersonates the legitimate "Pedágio Digital - Consorcio Rta e Ico Rodovias Mt" service, attempting to deceive visitors into entering sensitive financial or personal information under the guise of toll payment processing. Such phishing portals are commonly used to harvest login credentials, payment card details, or install malicious software through fake payment gateways or download prompts. The risk to users includes financial fraud, identity theft, and unauthorized access to linked accounts or systems. Analysis indicates this domain was registered on March 03, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with low-reputation domains. Infrastructure review reveals the domain resolves to IP address 187.110.162.234, hosted in Brazil under AS53107 (EVEO S.A.). The site lacks an SSL certificate, increasing the likelihood of data interception during transmission. At the time of assessment, 17 out of 95 security vendors on VirusTotal flagged icorodovias.top as malicious, with one security blocklist listing the domain. The page title and branding closely mimic official toll service providers, enhancing its credibility to unsuspecting users. If a user visited icorodovias.top or entered any information on the site, immediate action is required. First, disconnect the affected device from the network to prevent potential malware propagation or data exfiltration. Reset all credentials entered on the site, prioritizing financial accounts and email addresses. Monitor linked accounts for unauthorized transactions or login attempts. Scan the device using updated security tools to detect and remove any installed malware. Report the incident to relevant financial institutions and local cybersecurity authorities to assist in fraud prevention and domain takedown efforts. Users should also verify the legitimacy of any unexpected toll payment requests through official channels before proceeding with transactions.